Special crafted input data may be used to cause a denial of service
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
implementations. All systems using GPG to process incoming data are
affected..

The paper describes two attacks. The first attack allows
to distinguish keys: An attacker is able to notice which key is
currently used for decryption. This is in general not a problem but
may be used to reveal the information that a message, encrypted to a
commonly not used key, has been received by the targeted machine. We
do not have a software solution to mitigate this attack.

The second attack is more serious. It is an adaptive
chosen ciphertext attack to reveal the private key. A possible
scenario is that the attacker places a sensor (for example a standard
smartphone) in the vicinity of the targeted machine. That machine is
assumed to do unattended RSA decryption of received mails, for example
by using a mail client which speeds up browsing by opportunistically
decrypting mails expected to be read soon. While listening to the
acoustic emanations of the targeted machine, the smartphone will send
new encrypted messages to that machine and re-construct the private
key bit by bit. A 4096 bit RSA key used on a laptop can be revealed
within an hour.

Flush+Reload is a cache side-channel attack that monitors access to
data in shared pages. In this paper we demonstrate how to use the
attack to extract private encryption keys from GnuPG. The high
resolution and low noise of the Flush+Reload attack enables a spy
program to recover over 98% of the bits of the private key in a
single decryption or signing round. Unlike previous attacks, the
attack targets the last level L3 cache. Consequently, the spy
program and the victim do not need to share the execution core of
the CPU. The attack is not limited to a traditional OS and can be
used in a virtualised environment, where it can attack programs
executing in a different VM.